Sysmon
noun · also System Monitor · Microsoft Learn: Sysmon
A free Microsoft Sysinternals tool that runs as a Windows service and logs detailed process, network and file activity to the event log.
System Monitor (Sysmon) is part of Microsoft's Sysinternals suite. Once installed, it runs as a service and a driver and writes events to its own channel, Microsoft-Windows-Sysmon/Operational. It records far more detail than the built-in Windows logs: every process creation with its full command line, parent process and file hashes, network connections with the process that made them, DNS queries, driver loads, file creations, registry changes and more.
What Sysmon records is decided by an XML configuration file. Without one, it logs process creation and a few other basics; with a well-tuned configuration, it filters out routine noise and keeps the events that matter. Most teams start from a community-maintained configuration and adjust it. Sysmon only collects and logs: it does not block or alert by itself, so its events are usually forwarded to a SIEM.
Example
Event ID 1 (process creation) shows that winword.exe started powershell.exe with a long encoded command line, and event ID 3 a few seconds later shows that the same PowerShell process connected to an unknown IP address on port 443. Together, the two events describe a malicious document running a downloader.
Why it matters for a SOC analyst
Sysmon gives EDR-like visibility on machines that have no EDR, and many detection rules and threat-hunting queries are written against its events. Knowing its event IDs and fields helps you read investigations, write detections and spot when a host is missing the telemetry you need.
Articles that use this term
Tools · · 5 min read
Sysmon for beginners: the Windows visibility you are missing
What Sysmon records that default Windows logs miss, how to install it with a sensible configuration, and the event IDs a SOC analyst reads every day.
Related terms
- Windows event log
Windows' built-in record of system activity, organized in channels such as Security and System, where each event type has a numeric ID.
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- Threat hunting
The proactive search for attackers who are already inside the environment but have not triggered any alert, usually starting from a hypothesis.
- SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.
- Living off the land
Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.